multi-platform-search-searchapi
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the SearchAPI proxy andpython3to parse local configuration files for credential management. - [DATA_EXFILTRATION]: The skill instructions involve reading an API key from
~/.gooseworks/credentials.jsonand including it in requests to the vendor's API atapi.gooseworks.ai. As these are vendor-owned resources, the behavior is consistent with the skill's purpose but involves the handling of sensitive credentials. - [PROMPT_INJECTION]: The skill retrieves and processes untrusted data from various external platforms, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Retrieves search results, user comments, and transcripts from platforms including YouTube, Amazon, and TikTok (SKILL.md).
- Boundary markers: There are no defined boundary markers or instructions to isolate the retrieved data from the agent's control logic.
- Capability inventory: The skill possesses network communication capabilities through
curland local file reading throughpython3(SKILL.md). - Sanitization: No sanitization or validation of the external content is performed before processing.
Audit Metadata